CVE-2026-2003

CVE-2026-2003 is a medium-severity vulnerability affecting PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21. It involves improper validation of the "oidvector" type, allowing an authenticated database user to disclose a few bytes of server memory. The CVSS score of 4.3 indicates a low-privilege network attack with low impact on confidentiality and no impact on integrity or availability. While the potential for disclosing confidential information is considered unlikely, the vulnerability has a FAUCET Risk Score of 73/100. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog. However, it has garnered significant community attention with 3 mentions and 3 media articles, indicating awareness within the security community.